tailscale/tailscale · error

namedpipe.Listen: %w

Error message

namedpipe.Listen: %w

What it means

Raised in the Windows safesocket listen when winio.ListenPipe cannot create the named pipe with the required security descriptor. Another tailscaled instance already owns the pipe name or the process lacks rights to create it.

Source

Thrown at safesocket/pipe_windows.go:43

	return winio.DialPipeAccessImpLevel(ctx, path, windows.GENERIC_READ|windows.GENERIC_WRITE, winio.PipeImpLevelIdentification)
}

// windowsSDDL is the Security Descriptor set on the namedpipe.
// It provides read/write access to all users and the local system.
// It is a var for testing, do not change this value.
var windowsSDDL = "O:BAG:BAD:PAI(A;OICI;GWGR;;;BU)(A;OICI;GWGR;;;SY)"

func listen(path string) (net.Listener, error) {
	lc, err := winio.ListenPipe(
		path,
		&winio.PipeConfig{
			SecurityDescriptor: windowsSDDL,
			InputBufferSize:    256 * 1024,
			OutputBufferSize:   256 * 1024,
		},
	)
	if err != nil {
		return nil, fmt.Errorf("namedpipe.Listen: %w", err)
	}
	return &winIOPipeListener{Listener: lc}, nil
}

// WindowsClientConn is an implementation of net.Conn that permits retrieval of
// the Windows access token associated with the connection's client. The
// embedded net.Conn must be a go-winio PipeConn.
type WindowsClientConn struct {
	winioPipeConn
	tokenOnce sync.Once
	token     windows.Token // or zero, if we couldn't obtain the client's token
	tokenErr  error
}

// winioPipeConn is a subset of the interface implemented by the go-winio's
// unexported *win32pipe type, as returned by go-winio's ListenPipe
// net.Listener's Accept method. This type is used in places where we really are
// assuming that specific unexported type and its Fd method.

View on GitHub (pinned to 6e0912f979)

Solutions

1. Listening on the Windows named pipe failed; check for an existing tailscaled instance holding the pipe and for permission issues.

When it happens

Trigger: Thrown at safesocket/pipe_windows.go:43 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/12356f139bec9a5a. Report an issue: GitHub.